CC-496: fix Codex command-local guard bypass

[screenleon]

Summary

• make the documented command-local PM_GUARD_PM_BASH=off bypass work through the Codex PreToolUse transport
• keep the bypass anchored, case-sensitive, audited, and limited to one hook invocation
• add regression coverage for valid, malformed, and non-inherited bypass behavior

Root cause

Codex runs the PreToolUse hook before Bash interprets a leading environment assignment. The guard therefore could not observe PM_GUARD_PM_BASH=off even though its denial message recommended that exact one-turn remediation.

Validation

• Codex host guard suite: 43 passed, 0 failed
• shell lint and backlog lint passed
• Claude PR gate with explicit --test-cmd: GO (gate-20260715-044654-7da04e)
• live acceptance: the audited command-local bypass successfully removed all confirmed merged local branches

Cleanup result

Only main and this feature branch remain locally. Git has one worktree, and the pmctl worktree registry is empty.